Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

coturn: 4.5.1.3 -> 4.5.2 #109038

Merged
merged 1 commit into from Jan 15, 2021
Merged

coturn: 4.5.1.3 -> 4.5.2 #109038

merged 1 commit into from Jan 15, 2021

Conversation

0x4A6F
Copy link
Member

@0x4A6F 0x4A6F commented Jan 11, 2021

Motivation for this change

Upgrade to 4.5.2.

Version 4.5.2 'dan Eider':
	- fix null pointer dereference in case of out of memory. (thanks to Thomas Moeller for the report)
	- merge PR 517 (by wolmi)
		* add prometheus metrics
	- merge PR 637 (by David Florness)
	    * Delete trailing whitespace in example configuration files
	- merge PR 631 (by Debabrata Deka)
	    * Add architecture ppc64le to travis build
	- merge PR 627 (by Samuel)
		* Fix misleading option in doc (prometheus)
	- merge PR 643 (by tupelo-schneck)
		* Allow RFC6062 TCP relay data to look like TLS
	- merge PR 655 (by plinss)
		* Add support for proxy protocol V1
	- merge PR 618 (by Paul Wayper)
		* Print full date and time in logs
		* Add new options: "new-log-timestamp" and "new-log-timestamp-format"
	- merge PR 599 (by Cédric Krier)
		* Do not use FIPS and remove hardcode OPENSSL_VERSION_NUMBER with LibreSSL
	- update Docker mongoDB and fix with workaround the missing systemctl
	- merge PR 660 (by Camden Narzt)
		* fix compilation on macOS Big Sur
	- merge PR 546 (by jelmd)
		* Add ACME redirect url
	- merge PR 551 (by jelmd)
		* support of --acme-redirect <URL>
	- merge PR 672 further acme fixes (by jemld)
		* fix acme security, redundancy, consistency
	- Disable binding request logging to avoid DoS attacks. (Breaking change!)
		* Add new --log-binding option to enable binding request logging
	- Fix stale-nonce documentation. Resolves 604
	- Version number is changed to semver 2.0
	- Merge PR 288 (by Hristo Venev)
		* pkg-config, and various cleanups in configure file
	- Add systemd notification for better systemd integration
	- Fix Issue 621 (by ycaibb)
		* Fix: Null pointer dereference on tcp_client_input_handler_rfc6062data function
	- Fix Issue 600 (by ycaibb)
		* Fix: use-after-free vulnerability on write_to_peerchannel function
	- Fix Issue 601 (by ycaibb)
		* Fix: use-after-free vulnerability on write_client_connection function
	- Little refactoring prometheus
		* Fix c++ support
		* Simplify (as agreed in Issue 666)
			* Remove session id/allocation labels
			* Remove per session metrics. We should later add more counters.
	- Fix CVE-2020-26262 (credits: Enable-Security)
		* Fix ipv6 ::1 loopback check
		* Not allow allocate peer address 0.0.0.0/8 and ::/128
		* For more details see the github security advisory:
			https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p
Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

SuperSandro2000
SuperSandro2000 requested changes Jan 11, 2021
View reviewed changes
pkgs/servers/coturn/default.nix Outdated Show resolved Hide resolved
pkgs/servers/coturn/default.nix Outdated Show resolved Hide resolved
@mweinelt mweinelt added 1.severity: security 9.needs: port to stable A PR needs a backport to the stable release. labels Jan 11, 2021
@0x4A6F
coturn: 4.5.1.3 -> 4.5.2
bf89c49 
Version 4.5.2 'dan Eider':
	- fix null pointer dereference in case of out of memory. (thanks to Thomas Moeller for the report)
	- merge PR 517 (by wolmi)
		* add prometheus metrics
	- merge PR 637 (by David Florness)
	    * Delete trailing whitespace in example configuration files
	- merge PR 631 (by Debabrata Deka)
	    * Add architecture ppc64le to travis build
	- merge PR 627 (by Samuel)
		* Fix misleading option in doc (prometheus)
	- merge PR 643 (by tupelo-schneck)
		* Allow RFC6062 TCP relay data to look like TLS
	- merge PR 655 (by plinss)
		* Add support for proxy protocol V1
	- merge PR 618 (by Paul Wayper)
		* Print full date and time in logs
		* Add new options: "new-log-timestamp" and "new-log-timestamp-format"
	- merge PR 599 (by Cédric Krier)
		* Do not use FIPS and remove hardcode OPENSSL_VERSION_NUMBER with LibreSSL
	- update Docker mongoDB and fix with workaround the missing systemctl
	- merge PR 660 (by Camden Narzt)
		* fix compilation on macOS Big Sur
	- merge PR 546 (by jelmd)
		* Add ACME redirect url
	- merge PR 551 (by jelmd)
		* support of --acme-redirect <URL>
	- merge PR 672 further acme fixes (by jemld)
		* fix acme security, redundancy, consistency
	- Disable binding request logging to avoid DoS attacks. (Breaking change!)
		* Add new --log-binding option to enable binding request logging
	- Fix stale-nonce documentation. Resolves 604
	- Version number is changed to semver 2.0
	- Merge PR 288 (by Hristo Venev)
		* pkg-config, and various cleanups in configure file
	- Add systemd notification for better systemd integration
	- Fix Issue 621 (by ycaibb)
		* Fix: Null pointer dereference on tcp_client_input_handler_rfc6062data function
	- Fix Issue 600 (by ycaibb)
		* Fix: use-after-free vulnerability on write_to_peerchannel function
	- Fix Issue 601 (by ycaibb)
		* Fix: use-after-free vulnerability on write_client_connection function
	- Little refactoring prometheus
		* Fix c++ support
		* Simplify (as agreed in Issue 666)
			* Remove session id/allocation labels
			* Remove per session metrics. We should later add more counters.
	- Fix CVE-2020-26262 (credits: Enable-Security)
		* Fix ipv6 ::1 loopback check
		* Not allow allocate peer address 0.0.0.0/8 and ::/128
		* For more details see the github security advisory:
			GHSA-6g6j-r9rf-cm7p
@0x4A6F 0x4A6F mentioned this pull request Jan 11, 2021
Merged
10 tasks
@andir
Copy link
Member

andir commented Jan 11, 2021

FWIW: When we backport this to 20.09 please only backport the version change and not new features. Looking at the amount of changes it introduces it might be better to just apply https://github.com/coturn/coturn/commit/abfe1fd08d78baa0947d17dac0f7411c3d948e4d.patch

@SuperSandro2000
Copy link
Member

please only backport the version change and not new features.

How do you plan to do this? Remove the code that requires the new libraries?

@ofborg ofborg bot requested a review from Ralith January 11, 2021 22:01
@0x4A6F
Copy link
Member Author

0x4A6F commented Jan 14, 2021

If this isn't a blocking issue for this merge request, maybe discuss this in #109043?

@SuperSandro2000
Copy link
Member

If this isn't a blocking issue for this merge request, maybe discuss this in #109043?

I am not reading closed PRs.

@SuperSandro2000
Copy link
Member

Result of nixpkgs-review pr 109038 run on x86_64-darwin 1

1 package marked as broken and skipped:
  • coturn

@SuperSandro2000
Copy link
Member

This is a semi-automatic executed nixpkgs-review which does not build all packages (e.g. lumo, tensorflow or pytorch)
If you find some bugs or got suggestions for further things to search or run please reach out to SuperSandro2000 on IRC.

Result of nixpkgs-review pr 109038 run on x86_64-linux 1

1 package built:
  • coturn

@SuperSandro2000 SuperSandro2000 merged commit 14d1126 into NixOS:master Jan 15, 2021
@erictapen
Copy link
Member

Telling from the discussion, I'd assume this doesn't need a backport anymore.

@erictapen erictapen removed the 9.needs: port to stable A PR needs a backport to the stable release. label Jan 16, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mweinelt mweinelt mweinelt left review comments

@SuperSandro2000 SuperSandro2000 SuperSandro2000 requested changes

@Ralith Ralith Awaiting requested review from Ralith

Assignees
No one assigned
Labels
1.severity: security 10.rebuild-darwin: 1-10 10.rebuild-darwin: 1 10.rebuild-linux: 1-10 10.rebuild-linux: 1 11.by: package-maintainer
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@0x4A6F @andir @SuperSandro2000 @erictapen @mweinelt